colmmacc

34 ms·

361.
by colmmacc 10y ago
There is no (working!) https version of the domain. I own/maintain neverssl.com and I'll be doing my best to make sure that it can never poison the intended experience. I use it myself. Basically, it's designed to be easy to
362.
by colmmacc 10y ago
TLS 1.3 is still an evolving draft, and who knows what may change before it is standardized, but so far it does have some long-overdue simplifications to TLS. My favorite is that session resumption has been merged with pre-shared-key (PSK)
363.
by colmmacc 10y ago
There's a script provided by AWS dev-support which can help: https://github.com/aws/elastic-load-balancing-tools
364.
by colmmacc 10y ago
The very word "Ceremony" is a hint to the theatrics and purpose of the DNSSEC root key procedures. It's more about incanting a sense of authority in the integrity of DNS and creating the impression that DNSSEC provides some k
365.
by colmmacc 10y ago
ELBs (Classic and Application) do support IPv6. You can CNAME or ALIAS to dualstack.[elb-name].
366.
by colmmacc 10y ago
Alex, an SDE from AWS S3, recently added LibFuzzer fuzzing to s2n: https://github.com/awslabs/s2n/pull/263 . The integration has been very simple, very impressive, and it has already found an issue we hadn&#x
367.
by colmmacc 10y ago
Along the same lines, this paper is a great and slightly more comprehensive read on what TLS/HTTPS doesn't protect. https://www.teamupturn.com/static/reports/2016/what-isps-can...
368.
by colmmacc 10y ago
In general, our conference calls are structured and laser focused on recovery; "what can we rollback, undo, failover or change to restore availability?" There's much less emphasis on figuring out the root cause, or the "
369.
by colmmacc 10y ago
One of my responsibilities at Amazon is "call leader". It's a rotation of long-time Amazon folks who facilitate the recovery process whenever there are outage events; call leaders run the conference call (there's always
370.
by colmmacc 10y ago
They won't be split, bit one thing to watch out for is that they can be coalesced.
371.
by colmmacc 10y ago
Full disclosure: I'm an engineer at AWS and I work on NAT Gateway :) Thanks for the pointer to urllib3 - we'll take a look at it and see if there's anything we can do about the behavior. One of the challenges with sending &qu
372.
by colmmacc 11y ago
Another valuable takeaway is that forward secrecy is well worth having. In this case, any previously collected trove of sessions that used DHE/ECDHE is not de-cryptable by using DROWN.
373.
by colmmacc 11y ago
Not mentioned is a common pitfall with serving web sockets: it is very easy to end up in a situation where you may not recover from disruptions. The problem is that establishing a web socket, especially when using SPDY or HTTPS (which is ty
374.
by colmmacc 11y ago
IANA will officially assign numbers once the I-D has progressed to standard status. They'll show up here: http://www.iana.org/assignments/tls-parameters/tls-parameter... In the mean time, the I-D does contain
375.
by colmmacc 11y ago
Tthis is a devastating loss for all involved. Nóirín was active in Open Source, but something lesser known is that she was a founding director of Digital Rights Ireland; who recently succeeded in a legal challenge against European Data rete
376.
by colmmacc 11y ago
It depends on the size of the RSA key. With LogJam TLS_DHE_RSA_WITH_AES_256_CBC_SHA is likely weaker; with TLS_RSA_WITH_AES_256_CBC_SHA the client essentially makes up the shared secret, encrypts it using RSA and sends it to the server [1].
377.
by colmmacc 12y ago
DNSSEC is probably better described as a mechanism to prevent cache poisoning; which is different from the "modified in transit" case. DNSSEC isn't very useful for defending against a MITM: 1. If the MITM goal is to block you
378.
by colmmacc 12y ago
[Full disclosure: I've worked on Amazon Route 53] It's always neat to see nice data collection like this, but unfortunately the average speed to the authoritative name servers isn't a very meaningful measurement. Real world r
379.
by colmmacc 12y ago
My facts are right. As-deployed, clients don't validate DNSSEC; so the resolvers can pass on any response and the stubs/browsers will accept it. The signatures aren't being checked. Edit to update: The Turkish Government forg
380.
by colmmacc 12y ago
It's worth keeping in mind that the Turkish government hi-jacked DNS resolvers; as-deployed DNSSEC would in no way have helped. The 2008 attack was not novel and was described by DJB about 7 years prior to Kaminsky, and DJB's util
381.
by colmmacc 12y ago
There are at least two more arguments against DNSSEC: 1) DNSSEC does materially make DDOS reflection attacks worse. djb has gone on about this at length, so I won't. 2) DNSSEC also degrades a DNS server's ability to respond to req
382.
by colmmacc 12y ago
I'm not the OP, but I think it's fair to call it complex, and I'd pick three requirements out in particular. 1. Path reachability, MTU discovery and MSS interaction When sending outbound packets, you have to correlate incomin
383.
by colmmacc 12y ago
EDNS0 includes a mechanism for clients/resolvers to signal that they can handle a large/fragmented UDP response. At this point about 85% of requesters can handle UDP responses of at least 4K. For the moment, DNSSEC and EDNS0 are m
384.
by colmmacc 12y ago
Tip: If you're using >=2 providers to survive DDOS attacks, it's best to use no more than two name servers from any one provider. That's because resolvers will generally try up to 3 different name servers before giving up.
385.
by colmmacc 12y ago
It's not so simple. The larger the modulus, the larger the error; up to a limit. If the modulus is 2^30 + 2^29 for example, then values of r in the range 0 ... 2^29 will be represented twice as often as values in the range (2^29 + 1) .
386.
by colmmacc 12y ago
My own favourite random() in the wild bug is one that I've come across many many times: /* Generate a random number 0...5 inclusive */ int r = random() % 6; The problem is that this results in a bias towards ce
387.
by colmmacc 12y ago
Well, almost. AES-GCM is also "Cryptographically Broken" if you take into account software implementations using table lookup schemes that are subject to cache timing attacks. But the fundamental AEAD support in TLS1.2 is a much
388.
by colmmacc 12y ago
https://dns-api.com/ is a Git based Route 53 reseller ( https://dns-api.com/docs/ ). Netflix's denominator is also a great project for managing multi-provider pushes: https://github.com&#
389.
by colmmacc 12y ago
FYI: You can invalidate Public DNS's and OpenDNS's caches manually: https://developers.google.com/speed/public-dns/cache http://cachecheck.opendns.com/
390.
by colmmacc 12y ago
Propagation is bound at the DNS TTL plus whatever time it takes your DNS provider/setup to relay records to all of its authoritative servers.

More ›